NIS2 for SMEs: When Are You Affected and What Is Enough?

Written by the NIS2Compass editorial team / As of: November 2026

The NIS2UmsuCG has applied since 6 December 2025. An SME falls under it if it operates in a sector listed in Annex 1 or 2 of the BSIG and either employs at least 50 people or has an annual turnover and an annual balance sheet total each above EUR 10 million. Smaller companies usually feel NIS2 through the supply chain. The NIS2Compass scope check shows your classification straight away.

From How Many Employees Does NIS2 Apply to SMEs?

NIS2 applies to SMEs from 50 employees, or from annual turnover and balance sheet total each above EUR 10 million, provided the company operates in a regulated sector. This covers medium-sized enterprises as defined by the EU, but generally not small ones.

Two conditions must both be met: sector and size. The sector follows from Annexes 1 and 2 of the BSIG. The listed industries are covered in Am I affected by NIS2?. Size is governed by § 28(2) No. 3 BSIG.

The next tier sits much higher. An Annex 1 company only becomes a particularly important entity (essential entity under the Directive) from 250 employees, or more than EUR 50 million turnover plus more than EUR 43 million balance sheet total. Without special status, an SME is therefore at most an important entity. Special status applies, for example, to operators of critical facilities or providers of public telecommunications with 50 or more employees.

This group is large: the legislator expects around 21,600 important entities, 87% of them medium-sized enterprises (BT-Drs. 21/1501, p. 110 f.). The NIS2Compass scope check reflects exactly these thresholds.

Is Turnover Above EUR 10 Million Enough on Its Own?

No. The statutory text of § 28 BSIG links turnover and balance sheet total with "and". Both figures must each be above EUR 10 million. The employee threshold works on its own: from 50 employees, turnover and balance sheet no longer matter.

How Do Part-Time Staff and Trainees Count?

Staff are counted in annual work units (AWU), not heads, as required by the EU SME Recommendation referenced in § 28(4) BSIG. According to the BSI FAQ on NIS-2, part-time and seasonal workers count proportionally, and working owners are included. Trainees and periods of maternity or parental leave are not.

The latest annual financial statements are decisive. Seasonal peaks do not count; the status only changes after two consecutive financial years above or below the threshold.

Does a Company With 80 Employees Have to Comply With NIS2?

Yes, if it operates in a regulated sector. With 80 employees, it is above the threshold of 50 and, regardless of turnover, at least an important entity under § 28(2) BSIG. Without a link to a regulated sector, it remains outside NIS2 even with 80 employees.

Five examples show where the line runs:

• Automotive parts manufacturer, 80 employees, EUR 12 million turnover, EUR 9 million balance sheet total: The manufacture of parts for motor vehicles falls under Annex 2 No. 5.5 BSIG. With 80 annual work units, the employee threshold is reached. It lacks the Annex 1 activity and size for a particularly important entity. Result: important entity under § 28(2) No. 3(a) BSIG.
• Food wholesaler, 42 employees, EUR 14 million turnover, EUR 8 million balance sheet total: The sector fits (Annex 2 No. 4.1.1), the size does not. Turnover is above EUR 10 million, the balance sheet total is below. Result: not affected, provided no group data has to be added.
• Manufacturer of electronic components, 58 staff: The company (Annex 2 No. 5.2) employs 40 full-time staff, 12 part-time staff at 50 percent and 6 trainees. That gives 40 + 6 = 46 annual work units, below 50. With EUR 12 million turnover and EUR 11 million balance sheet total, however, the financial criterion applies. Result: important entity under § 28(2) No. 3(b) BSIG.
• Crossing the threshold in a single year: The wholesaler from the second example reports a one-off balance sheet total of EUR 11 million. The status only changes after two consecutive financial years above the threshold. Result: not affected for now, an important entity after the second year above it.
• Plastics processor with automotive customers, 80 employees: The manufacture of rubber and plastic products (NACE C22) is listed in neither Annex 1 nor Annex 2. Result: not affected under § 28 BSIG, provided there is no other activity in a regulated sector. NIS2 still reaches it via the supply chain, through its automotive customers.

For scale: by 30.09.2026, 13,252 important entities had registered with the BSI (BSI: NIS-2 in Zahlen). The legislator had expected around 21,600. You can check your own classification with the NIS2 scope check from NIS2Compass.

Do Group Companies and Partner Enterprises Count for SMEs?

In principle, yes: under § 28(4) BSIG the EU SME Recommendation applies, so linked enterprises count in full and partner enterprises proportionally. This does not apply if the company's IT design and operation are independent of the group. If the parent company runs all of its IT, that is generally not the case.

The attribution rule comes from Recommendation 2003/361/EC. According to the European Commission's User Guide to the SME Definition, holdings of 25 to 50 percent count proportionally, above 50 percent in full.

Each entity is assessed individually. According to the BSI FAQ, a parent company is not automatically covered just because its subsidiary is affected.

When Is a Subsidiary Independent of Group IT?

Group data "is not to be added" if the company is "independent with regard to the design and operation of its information technology systems, components and processes" (translated; § 28(4) BSIG). The explanatory memorandum to the act generally rules this out where the IT is operated entirely by a parent company. If the subsidiary has a service provider run its IT on its behalf, the memorandum says it usually exercises decisive influence itself (p. 145).

Suppose a subsidiary with 35 employees is wholly owned by a parent with 300 employees:

• IT runs entirely through group IT: The subsidiary counts 335 employees and, depending on sector, is an important or (Annex 1) particularly important entity.
• The subsidiary decides on the design and operation of its own IT: Only its own 35 employees count. Without meeting the financial criterion, it is not affected.

Record the result and your reasoning in writing.

Do Ancillary Activities Such as a PV System Count?

Under § 28(3) BSIG, negligible activities can be disregarded, such as a PV system for your own electricity needs. Within a group, the BSI FAQ treats an activity as negligible if it is only offered within the group and accounts for fewer than 50 employees and less than 10% of turnover and of balance sheet total respectively. If you offer the activity on the market, you cannot rely on this.

Which Small Companies Does NIS2 Affect Anyway?

Small companies are directly affected only in a few cases: as operators of critical facilities, DNS service providers, TLD registries, trust service providers or providers of public telecommunications. Far more often, NIS2 reaches them indirectly, because regulated customers must secure their supply chain (§ 30(2) No. 4 BSIG), for example through security questionnaires and contract clauses.

The act contains no dedicated exemption for small businesses. Small enterprises under the EU definition (fewer than 50 employees, turnover or balance sheet total up to EUR 10 million) simply fall below the thresholds of § 28 BSIG.

Which Entities Are Covered Regardless of Size?

• Always a particularly important entity: operators of critical facilities, qualified trust service providers, TLD registries and DNS service providers (§ 28(1) No. 1 and 2 BSIG).
• An important entity even as a small company: non-qualified trust service providers as well as providers of public telecommunications services and networks (§ 28(2) No. 1 and 2 BSIG). For the latter, the core obligations are handled via the TKG under § 28(5).

A common misconception concerns IT and platform providers. In Germany, the regular thresholds apply to managed service providers, cloud providers and online marketplaces.

What Do Suppliers Outside the Scope Need to Consider?

Regulated entities must ensure supply chain security, including security aspects of relationships with direct suppliers or service providers (§ 30(2) No. 4 BSIG). According to the BSI FAQ, these rules can "indirectly also affect companies not covered by NIS-2" (translated). In practice: customer questionnaires and contract clauses on risk management, incident reporting to the customer and patch management.

Suppliers outside the scope have no registration or reporting obligation of their own towards the BSI. The BSI suggests it may be worthwhile to review your measures against § 30(2) BSIG and use them to answer customer requirements. More on this under Supply chain and suppliers and in the article Security incident at a service provider: who reports?

What Is Enough for an SME That Falls Under NIS2?

Appropriate, proportionate and effective measures are enough. § 30 BSIG requires all ten minimum measures but lets you align depth and effort with size, risk and cost. Add registration, a reporting process, management training and documentation that makes your decisions traceable.

What Does "Proportionate" Mean Under § 30 BSIG?

§ 30(1) BSIG names the criteria explicitly: "the extent of risk exposure, the size of the entity, the implementation costs and the likelihood and severity of security incidents as well as their societal and economic impact" (translated).

Proportionate does not mean leaving measures out. Paragraph 2 requires "at least" (translated) ten areas, from risk analysis, backups and the supply chain to multi-factor authentication. Every area must be addressed; only the implementation scales. This includes incident handling (No. 2) as well as personnel security and access control (No. 9). According to the BSI FAQ, the depth of the risk analysis, for example, depends on the entity's size and risk profile.

Which Obligations Come on Top of the Ten Measures?

Registration under § 33 BSIG was due for existing companies by 6 March 2026. If you have not registered yet, catch up now. You report significant security incidents in stages after 24 hours, 72 hours and one month (§ 32 BSIG).

Management implements the measures, monitors them and regularly attends training (§ 38 BSIG, more on this under management liability under § 38 BSIG). And compliance "must be documented by the entities" (translated; § 30(1) sentence 3 BSIG). Also record why a measure has been kept lean.

How Strictly Is an SME Supervised?

The BSI supervises important entities ad hoc, when facts suggest a violation (§ 62 BSIG). There is no fixed audit cycle. § 39 BSIG requires evidence every three years only from operators of critical facilities. Ad hoc does not mean without consequences: if an inspection happens, say after an incident, your documentation shows what you have implemented.

The fine for important entities goes up to EUR 7 million (§ 65(5) BSIG). The turnover-based cap of 1.4% only takes effect from EUR 500 million in total turnover (§ 65(7)). For group subsidiaries, the worldwide turnover of their undertaking counts (§ 65(8)). There is no obligation to obtain ISO 27001 certification, as the article Do I need an ISMS for NIS2? explains.

How Much Effort Does the Legislator Estimate?

For important entities, the legislator estimates an average of around 1,100 staff hours and EUR 24,300 in material costs per year (BT-Drs. 21/1501, p. 111). For medium-sized enterprises, it assumes 35% of the effort of a particularly important entity, arithmetically closer to around 960 hours. 1,100 hours is roughly half to three quarters of a full-time position.

This is an average taken from an estimate, not a target. Your actual effort depends on your starting point and risk profile. For a breakdown by cost item, see NIS2 compliance costs.

What Should SMEs With a Small IT Team Prioritise?

First come the obligations that apply without delay: BSI registration, a working reporting channel and management taking on implementation and oversight. Next come the risk analysis and the measures with the most protection per unit of effort, such as multi-factor authentication, backups and patch management. Supply chain and effectiveness review complete the first cycle.

Suppose a food wholesaler (Annex 2 No. 4.1.1 BSIG) employs 120 people. The IT team has three people and there is no information security officer. That makes the company an important entity under § 28(2) No. 3 BSIG. For this example scenario, a six-month plan in three phases works well:

• Month 1: Obligations without delay. The company documents its scope assessment and completes the overdue registration with the BSI (§ 33 BSIG). In parallel, it sets up a reporting process for the 24-hour, 72-hour and one-month deadlines, with defined availability (§ 32 BSIG). Management takes on implementation and oversight (§ 38(1) BSIG) and schedules its own training (§ 38(3) BSIG).
• Months 2 and 3: Risk analysis and gap analysis. The IT team assesses the risks and compares the current state with the ten measures in § 30(2) BSIG. For three people, that means a compact analysis of critical processes like merchandise management, the cold chain and logistics.
• Months 4 to 6: Measures by impact. First up: multi-factor authentication (No. 10), backup with restore testing (No. 3), vulnerability and patch management (No. 5) and awareness training (No. 7). Then come the supply chain (No. 4), access control (No. 9), cryptography (No. 8) and the assessment of effectiveness (No. 6). The reporting process from month 1 already covers part of incident handling (No. 2).

Every decision needs a documented justification (§ 30(1) sentence 3 BSIG). A deliberately lean implementation is fine as long as its reasoning is traceable.

The legislator assumes that around 17% of affected companies already take adequate measures (BT-Drs. 21/1501, p. 111). For everyone else, the first cycle is genuine groundwork. How to do this with your own staff is shown in Implementing NIS2 without a consultant.

For the individual steps, the NIS2Compass Template Library has matching templates, for example for gap analysis, the reporting process and risk analysis. The template catalogue gives an overview.

Frequently Asked Questions

Can a company with 40 employees fall under NIS2 because of its turnover?

Yes, but only if annual turnover and annual balance sheet total are each above EUR 10 million and the company operates in a sector listed in Annex 1 or 2 of the BSIG. Turnover alone is not enough. A size-independent category or attributed group data can also apply. Otherwise, only indirect exposure through customers remains.

Does NIS2 affect mid-sized companies?

Yes, mid-sized companies are the core group. The legislator expects around 21,600 important entities, 87% of which are medium-sized enterprises (BT-Drs. 21/1501). A sector link is still required: a mid-sized company outside Annexes 1 and 2 of the BSIG is not directly in scope, but can be affected indirectly through regulated customers.

What happens if an SME only exceeds the threshold in one year?

Nothing at first. The latest annual financial statements are decisive, and the status only changes after two consecutive financial years above the threshold (BSI FAQ). This rule does not apply to newly founded companies. After the change in status, you have three months to register with the BSI (§ 33(1) BSIG).

How much does NIS2 compliance cost an SME?

For important entities, the legislator estimates an average of around 1,100 staff hours and EUR 24,300 in material costs per year (BT-Drs. 21/1501). According to the BDU fee study 2025, external consulting costs EUR 1,300 per day on average. More on this in the article What does external NIS2 consulting cost?

Does a small company have to meet its customers' NIS2 requirements?

Not by law, but often by contract. Under § 30(2) No. 4 BSIG, regulated customers must ensure the security of their supply chain and pass requirements on through contracts, for example on incident handling and patch management. According to the BSI FAQ, NIS2 thereby also has an indirect effect on companies outside the scope. A prepared answer setting out your own measures along the lines of § 30 makes sense.